I hope there is someone who can help me. I want to group events that occur within some milliseconds. I tried the transaction command to solve this problem but the minimum of maxpause seems to be 1s. So I don't know how to get rid of this problem. Perhaps there is another solution..
The aim is to get tuples of events that occur within some time interval.
You may try to use "streamstats" command to get the timestamp of previous event and calculate the duration from it. You can then group events with smaller duration. Something like this
your base search | streamstats current=f window=1 first(time) as prevTime | eval duration=time | eval shouldGroup=if(duration < yourMinduration,"Y","N") ....
Depending on your use case,
bucket may be of help:
base search | bucket _time span=25ms | stats something something by _time
I find a way to solve my problem.
I generate IDs for the events which should be grouping by this way:
First I used the delta command to get the difference "diff" between two Events then there is a chance to differ in ms
my base search | delta _time p=1 AS diff | eval ID=case(isnull(diff),1,diff>0.001,1,1=1,0) | accum ID
The result is a new field called ID which show the same ID for Events that occur within some milliseconds.
Thanks to somesoni2 who helped me solve this problem..